CVE-2018-21018 Auth bypass in n/a
Attackers can hijack accounts by exploiting improper session timeout handling during incomplete session establishment in Mastodon.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-21018?
CVE-2018-21018 is a critical authentication bypass vulnerability in n/a, published on 22 Sep 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mastodon before 2.6.3 mishandles timeouts of incompletely established sessions.
Weakness: CWE-613
Which versions are affected by CVE-2018-21018?
It affects 1 product.
Products include Joinmastodon Mastodon.
How do I fix CVE-2018-21018?
No fix has been published for CVE-2018-21018 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2018-21018 being exploited?
There is no known exploitation of CVE-2018-21018 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-36460 Mastodon vulnerable to arbitrary file creation through media attachments
- CVE-2022-2166 Improper Restriction of Excessive Authentication Attempts in mastodon/mastodon
- CVE-2022-24307 Missing authorization in n/a
- CVE-2024-23832 Mastodon Remote user impersonation and takeover
- CVE-2023-36459 Mastodon vulnerable to Cross-site Scripting through oEmbed preview cards
Sources
Also known as GHSA-4gqg-m5mw-g8mg.